Parties

Processor: KROMA UG (haftungsbeschränkt), Halberstädter Str. 17, 28215 Bremen, Germany, represented by Roman Koliada.

Controller: the business customer who entered into the service contract with the Processor ("Customer").

Contact for DPA: [email protected] and [email protected].

1. Subject matter and duration

The Processor processes personal data on behalf of the Customer to provide the contracted Flyzle SaaS services (AI-assisted content creation, scheduling, analytics, publishing). The DPA runs for the duration of the main services contract and any post-termination obligations.

2. Nature and purpose of processing

Hosting and storage of Customer Data; transmission to/from connected platforms chosen by the Customer; generation, transformation and moderation via AI providers chosen in the product; sending transactional and notification emails; analytics, logging, security monitoring and abuse prevention; support handling.

3. Types of personal data and data subjects

Data subjects: Customer's end users, employees, contractors, leads, prospects, customers and any individuals whose data the Customer uploads or whose accounts the Customer connects.

Data categories: contact details, account/profile data, content drafts and publications, media uploads, messaging history, scheduling metadata, billing references, IP/log data, integration tokens (encrypted), AI prompts and outputs, and any other categories the Customer chooses to upload.

4. Customer instructions

Processor processes personal data only on documented instructions from the Customer, including with regard to transfers, unless required to do so by EU or Member State law. The main services contract, the product UI, and additional written instructions constitute Customer instructions. The Processor will inform the Customer if an instruction infringes the GDPR.

5. Confidentiality

Personnel authorised to process the personal data are bound to confidentiality or are under an appropriate statutory obligation of confidentiality.

6. Technical and organisational measures (Art. 32 GDPR)

Encryption in transit (TLS) and encryption at rest for sensitive columns, including integration API keys and OAuth tokens, with rotating encryption keys.
Row-level access controls on multi-tenant data with least-privilege role separation.
Centralised authentication with token validation in privileged backend functions and protected administrative role checks.
Audit logging of administrative and account-deletion events; application error and performance monitoring with PII stripping.
Backups, point-in-time recovery and a documented 30-day account deletion grace period with cascading purge.
Vendor security reviews for subprocessors and granular cookie consent enforcement.

7. Subprocessors

The Processor uses the subprocessors listed at /subprocessors. The Customer grants general written authorisation to engage further subprocessors, provided the Processor informs the Customer of intended additions or replacements with reasonable notice and gives the Customer the opportunity to object on reasonable data-protection grounds.

8. International transfers

Where personal data is transferred outside the EU/EEA, the Processor relies on an adequacy decision, EU Standard Contractual Clauses (Module 2 or Module 3 as applicable, 2021/914), or another lawful transfer mechanism, supplemented by appropriate technical and organisational measures where required.

9. Assistance to the Controller

Taking into account the nature of processing and the information available, the Processor assists the Customer in fulfilling obligations to respond to data subject requests and to ensure compliance with Art. 32–36 GDPR (security, breach notification, DPIA, prior consultation).

10. Personal data breach notification

The Processor notifies the Customer without undue delay and in any event within 72 hours after becoming aware of a personal data breach affecting Customer Data. Notifications are sent to the Customer's primary administrative contact and to [email protected].

11. Return or deletion at end of services

At the choice of the Customer, the Processor deletes or returns all personal data after the end of the provision of services and deletes existing copies, unless EU or Member State law requires storage of the personal data. Self-service export is available at /data-deletion.

12. Audits

The Processor makes available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer. Audits are coordinated in advance, limited to once per calendar year (except in case of a documented incident), and conducted under confidentiality.

Where appropriate to satisfy the Customer's audit obligations, the Processor may provide remote audit documentation (security questionnaires, third-party reports, summaries of technical and organisational measures, and current subprocessor lists) in lieu of an on-site inspection.

13. Liability and governing law

Liability follows the main services contract. This DPA is governed by German law. Place of jurisdiction is Bremen, Germany, where legally permissible.

Execute the DPA

To countersign this DPA, send a signed copy or a confirmation email referencing your account email to [email protected]. We will return a counter-signed version.

A standalone PDF version can be requested at the same address.

Data Processing Agreement / Auftragsverarbeitungsvertrag (AVV)